Hardware Backdooring

World's First Portable Firmware Malware PoC

Rakshasa
Remote Exploits

First exploits against Windows 10 and Edge

SMBv2
Firmware Security

First exploits against Bitlocker and TrueCrypt

Firmware Security
Reverse Engineering

The Witchcraft Compiler Collection

WCC
Exploit Automation

Post Memory Corruption Memory Analysis

PMCMA

The Witchcraft Compiler Collection (WCC)

Towards Self Aware Computer Programs
(World class reverse engineering framework)

Advances in REVERSE ENGINEERING of BINARY programs

With this presentation, we take a new approach to reverse engineering. Instead of attempting to decompile code, we seek to undo the work of the linker and produce relocatable files, the typical output of a compiler. The main benefit of the later technique over the former being that it does work. Once achieved universal code ‘reuse’ by relinking those relocatable objects as arbitrary shared libraries, we'll create a form of binary reflection, add scripting capabilities and in memory debugging using a JIT compiler, to attain automated API prototyping and annotation, which, we will argue, constitutes a primary form of binary code self-awareness. Finally, we'll see how abusing the dynamic linker internals shall elegantly solve a number of complex tasks for us, such as calling a given function within a binary without having to craft a valid input to reach it. The applications in terms of vulnerability exploitation, functional testing, static analysis validation and more generally computer wizardry being tremendous, we'll have fun demoing some new exploits in real life applications, and commit public program profanity, such as turning PEs into ELFs, functional scripting of sshd in memory, stealing crypto routines without even disassembling them, among other things that were never supposed to work. All the above techniques have been implemented into the Wichcraft Compiler Collection, released as open source software (MIT/BSD-2 licenses).

This presentation has been given at:

Defcon 24 (Las Vegas)
Blackhat EU 2016 (London)
H2HC (Sao Paolo)
Intel ISecCon (Hillsboro)
BSides (San Francisco) 2017

The code of the Wichcraft Compiler Collection is License under Open Source Lincenses (MIT/BDS2). It is available on the github wcc reporitory.

The slides of the Witchcraft Compiler Collection presentations are available on the author's slideshare.

WCC Resources

DEF CON 24 - Presentation

Witchcraft Resources

Towards Self Aware Computer Programs
(World class reverse engineering framework)

SMB v2

Sharing more than your files
(World's first exploits against Windows 10 and Microsoft Edge)

World's First exploits against windows 10 and microsoft EDGE

In this presentation, we detail a new attack vector against SMBv2, affecting all versions of IE, including the Spartan version shipped with Windows10. While attacks involving SMB have long time been common in LANs, our attack allows complete user compromise from the internet. By leveraging a series of bugs and malfunctions, we'll see how remote credentials theft or user impersonation can be performed without user interaction, extremely reliably, and from the Internet.

Blackhat (Las Vegas) 2015

The original whitepaper is archived on the Blackhat website. The latest version is available on slideshare.

Dark Readings article on our Blackhat presentation. Read here.

SMBv2 Resources

Blackhat USA 2015 - Presentation

SMB Resources

SMBv2 : Sharing more than your files
(World's first exploits against Windows 10 and Microsoft Edge)

First Windows 10 exploit

Dark Readings article on our Blackhat presentation. Read here.

AUG 2015

Whitepaper

The original whitepaper is archived on the Blackhat website. The latest version is available on slideshare.

AUG 2015

Slides

The material of our presentation is available here.

AUG 2015

Filecry (Co-Author)

The new age of XXE
(Remote exploits against Microsoft Internet Explorer)

Filecry : Internet explorer CVE-2015-1646 and MS15-039

Xml eXternal Entities (XXE) is one of the deadliest vulnerabilities on the Internet, and we will demonstrate how critical enterprise software packages are still vulnerable to these attacks today. In this action-packed presentation, we will demonstrate two 0-day vulnerabilities we identified in both popular server (Java) and client-side (Internet Explorer) technologies. The first vulnerability can be exploited with an attacker-controlled XML leading to arbitrary file ex-filtration on a target server even with all the Java protections enabled. The second vulnerability allows an attacker to steal both arbitrary files on the local hard drive and secret information across origins with a malicious webpage. Therefore, effectively bypassing the Same Origin Policy and breaching the web-local separation. Both exploits are reliable and do not depend on memory corruptions.

The Microsoft security bulletin for MS15-039 (Important) is available on the Microsoft website.Microsoft's acknowledgment to the Salesforce team is archived here.

The technical whitepaper is available on slideshare.

Read the advisory for CVE-2015-1646.

Filecry Resources

The new age of XXE
(Remote exploits against Microsoft Internet Exlporer)

Advisory MS15-039 and CVE-2015-1646

The Microsoft security bulletin for MS15-039 (Important) is available on the Microsoft website.

AUG 2015

Whitepaper

The original whitepaper is archived on the Blackhat website. The latest version is available on slideshare.

AUG 2015

Slides

The material of our presentation is available here.

AUG 2015

JAVA JDK Defenseless against XML Parsers (Co-Author)

The new age of XXE
(Remote Oracle Java exploits)

JDK Defenseless against XML Parsers

The technical whitepaper is available here.

Multiple Java XML parsers are vulnerable to XXE attack. We identified in particular XXE vulnerabilities in:

avax.xml.stream.XMLInputFactory
avax.xml.parsers.DocumentBuilderFactory
avax.xml.parsers.SAXParserFactory
avax.xml.transform.sax.SAXTransformerFactory
javax.xml.transform.TransformerFactory
avax.xml.validation.SchemaFactory
javax.xml.validation.Validator
avax.xml.bind.Unmarshaller
javax.xml.xpath.XPathExpression

Responsible disclosure was handled directly with Oracle. Some of the vulnerabilities we identified have been granted their own CVEs after other researchers reported them independently subsequently:

Read the advisory for CVE-2017-18197.
Read the advisory for CVE-2017-7503.
Read the advisory for CVE-2015-0408.

XXE Java Resources

JAVA XXE Resources

The new age of XXE
(Remote Oracle Java exploits)

Advisories

The security bulletin for CVE-2017-18197 is available on the MITRE website.

The security bulletin for CVE-2017-7503 is available on the MITRE website.

The security bulletin for CVE-2015-0408 is available on the MITRE website.

AUG 2015

Whitepaper

The original whitepaper is archived on the Blackhat website. The latest version is available on slideshare.

AUG 2015

Slides

The material of our presentation is available here.

AUG 2015

Rakshasa

Hardware Backdooring is Practical
(The World's FIRST Public Firmware Backdoor)

Rakshasa Hardware Backdooring is Practical

This presentation will demonstrate that permanent backdooring of hardware is practical. We have built a generic proof of concept malware for the intel architecture, Rakshasa, capable of infecting more than a hundred of different motherboards. The first net effect of Rakshasa is to disable NX permanently and remove SMM related fixes from the BIOS, resulting in permanent lowering of the security of the backdoored computer, even after complete erasing of hard disks and reinstallations of a new operating system. We shall also demonstrate that pre-existing work on MBR subversions such as bootkiting and preboot authentication software brute force can be embedded in Rakshasa with little effort. More over, Rakshasa is built on top of free software, including the Coreboot project, meaning that most of its source code is already public. This presentation will take a deep dive into Coreboot and hardware components such as the BIOS, CMOS and PIC embedded on the motherboard, before detailing the inner workings of Rakshasa and demo its capabilities. It is hoped to raise awareness of the security community regarding the dangers associated with non open source firmware shipped with any computer and question their integrity. This shall also result in upgrading the best practices for forensics and post intrusion analysis by including the afore mentioned firmware as part of their scope of work.

This presentation has been given at:

Defcon 20 (Las Vegas) 2012
Blackhat (Las Vegas) 2012
Intel IsecCon (Hillsboro) 2012
NoSuchCon (Paris) 2012
Ruxcon (Melbourne) 2012
NullCon (Goa) 2013
NullCon X (Goa) 2019

The technical whitepaper is available here.

Read the slides on DEF CON 20 archives.

Read the summary from the MIT Technology Review.
Read the post from Forbes.

Rakshasa Resources

DEF CON 20 - Presentation

Rakshasa Resources

Hardware Backdooring is Practical
(The World's FIRST Public Firmware Backdoor)

The world's first Hardware Backdoor

Wikipedia describes Rakshasa as the first public demonstration of a permanent firmware backdoor.

AUG 2012

Whitepaper

The original slides are archived on the DEF CON website. The latest version is available on slideshare (190 000+ views).

AUG 2012

MIT Technology Review

Rakshasa has been featured in the MIT Technology review as a backdoor "Undetectable and Uncurable".

AUG 2012

Forbes Review

Forbes published an article outlining the disruptive innovations behind Rakshasa.

AUG 2012

Slides

Download the Slides of Rakshasa's presentation at Blackhat USA 2012.

AUG 2012

Blackhat Presentation

Attend Rakshasa's presentation with this video from Blackhat USA 2012.

AUG 2012

PMCMA

Post Memory Corruption Memory Analysis
(Automating exploitation of arbitrary writes)

PMCMA Post Memory Corruption Memory Analysis

In this presentation, we introduce a new exploitation methodology of invalid memory reads and writes, based on dataflow analysis after a memory corruption bug has occurred inside a running process.
We will expose a methodology which shall help writting a reliable exploit out of a PoC triggering an invalid memory write, in presence of security defense mechanisme such as compiler enhancements (full RELRO, SSP...), or kernel anti exploitation features (ASLR, NX...).
We will demonstrate how to find all the function pointers inside a running process, how to determine which ones would have been de-referenced after the crash, which ones are truncable (in particular with 0x00000000). In case all of the above fail, how to test for specific locations overwrites in order to indirectly trigger a second vulnerability allowing greater control and eventually control flow hijacking. All of the above without source code, indeed.
In the case of invalid memory reads, we will exemplify how indirectly influence the control flow of execution by reading arbitrary values, how to trace all the unaligned memory access and how to test if an invalid read can be turned into an invalid write or used to infer the mapping of the binary. We will also introduce a new debugging technique which allows for very effective testing of all of the above by forcing the debugged process to fork(). Automatically. And with a rating of the best read/write location based on probabilities of mapping addresses (because of ASLR).
Finally, since overwriting function pointers doesn't allow direct shellcode execution because of W^X mappings, we introduce a new exploitation technique which works even in the most hardcore kernels such as grsecurity. IT is called "stack desynchronization" and allows frame faking inside the stack itself.
Those techniques are implemented in the form of a proof of concept tool running under x86 GNU/Linux available as open source : here.

This presentation has been given at:

Blackhat (Las Vegas) 2011
CCC (Berlin) 2011
Hack In the Box (Kuala Lumpur) 2011
NoSuchCon (Paris) 2011
Ruxcon (Melbourne) 2011
Kiwicon (New Zealand) 2011

The technical whitepaper is available from the CCC and Blackhat archives.

Read the slides from the CCC conference.

PMCMA Resources

Blackhat 2011 - Presentation

PMCMA Resources

Post Memory Corruption Memory Analysis
(Automating exploitation of arbitrary writes)

Source Code

The PMCMA debugger is free software (Apache License) and is available on github.

AUG 2011

Whitepaper

The original whitepaper is archived on the Blackhat website. The latest version is available on slideshare.

AUG 2011

Slides

Download the Slides of PMCMA's presentation from the archives of Blackhat USA 2011.

AUG 2011

CCC 28c3 - Presentation

Breaking Virtualization

By switching the cpu to 8086 mode

Breaking Virtualization By switching the cpu to 8086 mode

In the last 5 years, virtualization software has been massively adopted by companies as a mean to reduce costs, achieve instant scalability, and possibly better their security through isolation. Recent numbers indicate that 78 percent of companies have their production servers virtualized, and 20 percent of them actually only rely on virtualized servers. At the same time, security auditing of such software poses unique challenges, in particular when it comes to dynamic testing. In this paper, we describe a methodology for the security assessment of virtualization software based on switching the CPU mode to virtual 8086 mode in order to get access to the (possibly virtualized) hardware, that aims at being both generic (applicable to both x86 and x64 architectures) and extremely large in terms of code coverage. We have implemented this technology under the form of a dynamic testing tool which has proved to be very efficient in finding bugs in virtualization software.

Presentations
Slides

This presentation has been given at:

Hackito Ergo Sum (Paris) 2010
HITB (Kuala Lumpur) 2010
HITB (Amsterdam) 2010
H2HC (Sao Paolo) 2010
Ruxcon (Melbourne) 2010

Read the slides from the HITB Amsterdam and HITB Kuala Lumpur conferences.

Breaking Virtualization Resources

Hack in the Box - Presentation

Breaking Virtualization Resources

By switching the cpu to 8086 mode

HITB Amsterdam Slides

Download the Slides of this presentation from the archives of HITB Asmterdam website.

JUL 2010

Ruxcon Slides

Download the Slides of this presentation from the archives of Ruxcon website.

NOV 2010

HITB Kuala Lumpur Slides

Download the Slides of this presentation from the archives of HITB Kuala Lumpur website.

OCT 2010

Bypassing Pre-Boot Authentication Passwords By Instrumenting The BIOS Keyboard Buffer

(Practical Low Level Attacks Against x86 Pre-Boot Authentication Software)

Bypassing Pre-Boot Authentication Passwords By Instrumenting The BIOS Keyboard Buffer

Pre-boot authentication software, in particular full hard disk encryption software, play a key role in preventing information theft. In this paper, we present a new class of vulnerabilities affecting multiple high value pre-boot authentication software, including the latest Microsoft disk encryption technology : Microsoft Vista's Bitlocker, with TPM chip enabled. Because Pre-boot authentication software programmers commonly make wrong assumptions about the inner workings of the BIOS interruptions responsible for handling keyboard input, they typically use the BIOS API without flushing or initializing the BIOS internal keyboard buffer. Therefore, any user input including plain text passwords remains in memory at a given physical location. In this article, we first present a detailed analysis of this new class of vulnerabilities and generic exploits for Windows and Unix platforms under x86 architectures. Unlike current academic researches aiming at extracting information from the RAM, our practical methodology does not require any physical access to the computer to extract plain text passwords from the physical memory. In a second part, we will present how this information leakage combined with usage of the BIOS API without careful initialization of the BIOS keyboard buffer can lead to computer reboot without console access and full security bypass of the pre-boot authentication pin if an attacker has enough privileges to modify the bootloader. Other related work includes information leakage from CPU caches, reading physical memory thanks to firewire and switching CPU modes.

The following advisories have been published as part of this research:

CVE-2008-3893 (Microsoft Vista Bitlocker Disk Encryption)
CVE-2008-3899 (TrueCrypt)
CVE-2008-3901 (Linux Kernel/Software Suspend)
CVE-2008-3900 (Intel BIOS Firmware)
CVE-2008-3898 (Drive Crypt Secustar)
CVE-2008-2897 (DiskCryptor)
CVE-2008-3896 (Grub)
CVE-2008-3895 (LILO)
CVE-2008-3902 (HP BIOS Firmware)
CVE-2008- 2894 (IBM Lenovo Firmware)
CVE-2005-4176 (Award BIOS Firmware)
CVE-2005-4175 (Insyde BIOS Firmware)
IVIZ-08-010 (McAfee SafeBoot)

Listen to the audio recording from the DEC CON 16 archives.

Read the slides from the DEC CON 16 archives.

This presentation has been given at DEF CON 16 (2008).

PreBoot Authentication Bypass Resources

Bypassing Pre-Boot Authentication Passwords By Instrumenting The BIOS Keyboard Buffer Resources

(Practical Low Level Attacks Against x86 Pre-Boot Authentication Software)

All previous Publications

DEFCON 24 Witchcraft Compiler Collection

AUG 2016

DEFCON 16 - BIOS: Bypassing Preboot Authentication Passwords

AUG 2008

28c3 Chaos Computer Conference

DEC 2011

BIOS Information leakage

SEP 2005

Blackhat 2015 SMB Sharing More than your files

AUG 2015

INTEL iSEC 2016

NOV 2016

Blackhat 2015 SMBv2 Sharing More Than Just Your Files

AUG 2015

INTEL iSEC 2012

NOV 2012

Ruxmon 2012 Reverse Engineering Proprietary Protocols

JUN 2012

SYSCAN 2013

JUN 2013

Shakacon 2017 Silent Protest

JUN 2017

Blackhat 2015 XXE Defenseless JDK XML Parsers JAVA

AUG 2015

Blackhat Europe 2016 Witchcraft Compiler Collection-Towards Self Aware Computer Programs-wp

OCT 2016

Blackhat USA 2011 Post Memory Corruption Memory Analysis PMCMA

AUG 2011

Blackhat USA 2012 Hardware Backdooring is Practical

AUG 2012

CCC 2012

DEC 2012

Blackhat 2011 Post Memory Corruption Memory Analysis Whitepaper

AUG 2011

Blackhat 2015 Filecry the new age of xxe

AUG 2015

DEFCON 16 Bitlocker

AUG 2008

DEFCON 20 Hardware Backdooring is Practical

AUG 2012

DEFCON 24 Introduction-to-the-Witchcraft-Compiler-Collection

AUG 2016

Blackhat 2011.WP

AUG 2011

H2HC 2009

NOV 2009

HackitoErgoSum 2010

APR 2010

H2HC 2010

NOV 2010

H2HC 2013

NOV 2013

HITB 2010 Amsterdam

MAR 2010

TELECOMX 2009

JUN 2009

HITB 2010 KualaLumpur

OCT 2010

Auscert 2013 Hardware Backdooring

OCT 2013

BSides San Francisco 2016 Witchcraft Compiler Collection

MAR 2016

HITB 2011

APR 2011

HITB 2011 Breaking Virtualization 8088 mode

OCT 2011

HackitoErgoSum 2010 Breaking Virtualization 8088 mode

APR 2010

H2HC 2013 Sandboxing

NOV 2013

H2HC Breaking Preboot Authentication

NOV 2009

Kiwicon 2011

OCT 2011

NULLCON 2012

MAY 2012

HITB 2011 PMCMA

NOV 2011

NULLCON 2019

MAY 2019

Syscan 2013 Sandboxing

NOV 2013

WCC internal documentation

AUG 2016

NoSuchCon Hardware Backdooring Is Practical

APR 2013

RUXCON 2010

OCT 2010

Blackhat 2016 Witchcraft-Compiler-Collection User Manual

AUG 2016

RUXCON 2011

OCT 2011

HackitoErgoSum 2012

APR 2012

RUXCON 2012

APR 2012

RUXCON 2013

APR 2013

ClubHack 2008

OCT 2008

blackhat2012

AUG 2012

Associated Tools

Press review

Global coverage

Researcher Jonathan Brossard has innovated a uniquely nasty coding trick: A strain of malware that's nearly impossible to disinfect.

Andy Greenberg

Journalist - Forbes

A hacker demonstrates that code can be hidden inside a new computer to put it forever under remote control.

Tom Simonite

Writer - MIT Technology Review

Mr Brossard is one of the world’s best-known ‘‘ethical hackers’’, and uses his computer skills to help companies strengthen their cybersecurity.

Tim Barlass

Reporter - Sydney Morning Herald

The Witchcraft Compiler Collection (WCC)

Towards Self Aware Computer Programs(World class reverse engineering framework)

Advances in REVERSE ENGINEERING of BINARY programs

DEF CON 24 - Presentation

Witchcraft Resources

Towards Self Aware Computer Programs(World class reverse engineering framework)

Codebase

WCC DEF CON 24 Presentation

Documentation

Witchcraft Blackhat 2016

WCC Slides (slideshare)

WCC user manual

Package

WCC BSidesSF Presentation

WCC Slides

SMB v2

Sharing more than your files(World's first exploits against Windows 10 and Microsoft Edge)

World's First exploits against windows 10 and microsoft EDGE

Blackhat USA 2015 - Presentation

SMB Resources

SMBv2 : Sharing more than your files(World's first exploits against Windows 10 and Microsoft Edge)

Filecry (Co-Author)

The new age of XXE(Remote exploits against Microsoft Internet Explorer)

Filecry : Internet explorer CVE-2015-1646 and MS15-039

Filecry Resources

The new age of XXE(Remote exploits against Microsoft Internet Exlporer)

JAVA JDK Defenseless against XML Parsers (Co-Author)

The new age of XXE(Remote Oracle Java exploits)

JDK Defenseless against XML Parsers

JAVA XXE Resources

The new age of XXE(Remote Oracle Java exploits)

Rakshasa

Hardware Backdooring is Practical(The World's FIRST Public Firmware Backdoor)

Rakshasa Hardware Backdooring is Practical

DEF CON 20 - Presentation

Rakshasa Resources

Hardware Backdooring is Practical(The World's FIRST Public Firmware Backdoor)

PMCMA

Post Memory Corruption Memory Analysis(Automating exploitation of arbitrary writes)

PMCMA Post Memory Corruption Memory Analysis

Blackhat 2011 - Presentation

PMCMA Resources

Post Memory Corruption Memory Analysis(Automating exploitation of arbitrary writes)

CCC 28c3 - Presentation

Breaking Virtualization

By switching the cpu to 8086 mode

Breaking Virtualization By switching the cpu to 8086 mode

Hack in the Box - Presentation

Breaking Virtualization Resources

By switching the cpu to 8086 mode

Bypassing Pre-Boot Authentication Passwords By Instrumenting The BIOS Keyboard Buffer

(Practical Low Level Attacks Against x86 Pre-Boot Authentication Software)

Bypassing Pre-Boot Authentication Passwords By Instrumenting The BIOS Keyboard Buffer

Bypassing Pre-Boot Authentication Passwords By Instrumenting The BIOS Keyboard Buffer Resources

(Practical Low Level Attacks Against x86 Pre-Boot Authentication Software)

All previous Publications

Associated Tools

Press review

Global coverage

Andy Greenberg

Journalist - Forbes

Tom Simonite

Writer - MIT Technology Review

Tim Barlass

Reporter - Sydney Morning Herald

Towards Self Aware Computer Programs
(World class reverse engineering framework)

Towards Self Aware Computer Programs
(World class reverse engineering framework)

Sharing more than your files
(World's first exploits against Windows 10 and Microsoft Edge)

SMBv2 : Sharing more than your files
(World's first exploits against Windows 10 and Microsoft Edge)

The new age of XXE
(Remote exploits against Microsoft Internet Explorer)

The new age of XXE
(Remote exploits against Microsoft Internet Exlporer)

The new age of XXE
(Remote Oracle Java exploits)

The new age of XXE
(Remote Oracle Java exploits)

Hardware Backdooring is Practical
(The World's FIRST Public Firmware Backdoor)

Hardware Backdooring is Practical
(The World's FIRST Public Firmware Backdoor)

Post Memory Corruption Memory Analysis
(Automating exploitation of arbitrary writes)

Post Memory Corruption Memory Analysis
(Automating exploitation of arbitrary writes)